code: fix variables merge order

[tarunKoyalwar]

Proposed Changes

• fix variables merge order in code protocol
• in Issue while running code protocol #4621 precedence was given to raw variables over evaluated variables i.e why after {{BaseURL}} was converted to https://scanme.sh (or any url) it was replaced by {{BaseURL}} again .
• fixed line break when printing extracted results in normal mode

# earlier
[code-template] [http] [info] https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gK [https://scanme.sh
extracted
]

# after fix
[code-template] [http] [info] https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg== ["https://scanme.sh\nextracted"]

• closes Issue while running code protocol #4621
• closes code: Interpret Env Variables while printing source code in debug mode #4624

[tarunKoyalwar]

example template

id: code-template

info:
  name: example code template
  author: pdteam
  severity: info

variables:
  OAST: "{{BaseURL}}"

code:
  - engine:
      - sh
      - bash
    source: |
      echo "$OAST\nextracted" | base64 
http:
  - raw:
      - |
        GET /{{code_response}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200

    extractors:
      - type: dsl
        dsl:
          - base64_decode(code_response)
# digest: 4a0a00473045022100b07735c7ab49a35adb85026190594d285fd3a4567db180b34fca8a7b91f3957f022048a4005633759ba3a0db2bbb04be563900827ef49436ed744f539501c566cb31:73812c4e0e52692225979bd2d5f05a3c

$  ./nuclei -t a.yaml -code -v -u https://scanme.sh 

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.5

		projectdiscovery.io

[VER] Started metrics server at localhost:9092
[INF] Current nuclei version: v3.1.5 (latest)
[INF] Current nuclei-templates version: v9.7.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from tarun
[INF] Targets loaded for current scan: 1
[VER] [code-template] Executed code on local machine https://scanme.sh
[VER] [code-template] Sent HTTP request to https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg==
[code-template] [http] [info] https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg== ["https://scanme.sh\nextracted"]

[tarunKoyalwar]

New Changes

• Intepret env variables in debug mode while printing code protocol source code code: Interpret Env Variables while printing source code in debug mode #4624

$ ./nuclei -t a.yaml -code -v -u https://scanme.sh  -debug

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.1.5

		projectdiscovery.io

[INF] Current nuclei version: v3.1.5 (latest)
[INF] Current nuclei-templates version: v9.7.2 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 61
[INF] Templates loaded for current scan: 1
[INF] Executing 1 signed templates from tarun
[INF] Targets loaded for current scan: 1
[DBG] [code-template] Dumped Executed Source Code for https://scanme.sh

echo "'https://scanme.sh'\nextracted" | base64 

[DBG] [code-template] Dumped Code Execution for https://scanme.sh

aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg==

[INF] [code-template] Dumped HTTP request for https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg==

GET /aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg== HTTP/1.1
Host: scanme.sh
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept-Encoding: gzip

[DBG] [code-template] Dumped HTTP response https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg==

HTTP/1.1 200 OK
Connection: close
Content-Length: 2
Content-Type: text/plain; charset=utf-8
Date: Thu, 11 Jan 2024 20:35:56 GMT

ok
[code-template:status-1] [http] [info] https://scanme.sh/aHR0cHM6Ly9zY2FubWUuc2gKZXh0cmFjdGVkCg== ["https://scanme.sh\nextracted"]

• update integration tests to reflect new behaviour of escaped control characters (\r\n) in extracted values in terminal mode